Blockchain investigator ZachXBT disclosed that he infiltrated a Chinese cryptocurrency money laundering group operating in 2025, following a major theft from the Bybit exchange.
The infiltration began in February, shortly after Bybit was hacked by a group called TraderTraitor, which siphoned over $1.5 billion in crypto assets from the exchange. ZachXBT identified users in public Discord and Telegram groups requesting support for transactions linked to the stolen funds.
Posing as a customer, ZachXBT deposited nearly $350,000 USDC into an address to conduct transactions and build trust with an account operator tied to the Bybit hack funds. Through successive exchanges, ZachXBT established rapport with the individual and gained access to operational details about the laundering group's activities.
According to communications ZachXBT disclosed, the group claimed responsibility for laundering most of the $1.5 billion from the Bybit hack. ZachXBT identified a cluster of $12 million in Bybit exploit funds that were swapped between Bitcoin, Ethereum, Solana, and Tronix in real time. He also traced $3 million laundered through the group to Huione Guarantee, a peer-to-peer marketplace.
ZachXBT noted that the intelligence gathered from the operation helped freeze approximately $75 million in stolen funds, including 442,000 USDT frozen by Tether. He emphasized that he funded the undercover operation independently, incurring 5% losses on each transaction and risking financial and personal security.
